tcp: handle pure FIN case correctly

When skb->len==0, the recv_actor() returns 0 too, but we also use 0
for error conditions. This patch amends this by propagating the errors
to tcp_read_skb() so that we can distinguish skb->len==0 case from
error cases.

Fixes: 5b1c8052b4a6 ("tcp: Introduce tcp_read_skb()")
Reported-by: Eric Dumazet <edumazet@google.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index f47338d89d5d504ff46b91b1fdb596089cea06cc..59e75ffcc1f4085710c56c9461c4a82dd1b3882c 100644 (file)
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -1194,8 +1194,9 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb)
                ret = bpf_prog_run_pin_on_cpu(prog, skb);
                ret = sk_psock_map_verd(ret, skb_bpf_redirect_fetch(skb));
        }
-       if (sk_psock_verdict_apply(psock, skb, ret) < 0)
-               len = 0;
+       ret = sk_psock_verdict_apply(psock, skb, ret);
+       if (ret < 0)
+               len = ret;
 out:
        rcu_read_unlock();
        return len;

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 56a554b49caa6189a1ef178122e89eedc6409fed..bbe2187536620a9300ef7350e08c861625c042c0 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1768,7 +1768,7 @@ int tcp_read_skb(struct sock *sk, skb_read_actor_t recv_actor)
        __skb_unlink(skb, &sk->sk_receive_queue);
        WARN_ON(!skb_set_owner_sk_safe(skb, sk));
        copied = recv_actor(sk, skb);
-       if (copied > 0) {
+       if (copied >= 0) {
                seq += copied;
                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                        ++seq;